12:34 p.m.
So, what to do about scope and client templates? Client templates could
have "full scope allowed" or define a scope. A client would either
click "full scope allowed" or it can add additional scoped roles.
Sound ok?
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
8:22 a.m.
On 15/12/15 18:34, Bill Burke wrote:
So, what to do about scope and client templates? Client templates
could
have "full scope allowed" or define a scope. A client would either
click "full scope allowed" or it can add additional scoped roles.
Sound ok?
yes to me. I suppose each client will still automatically receives his
own client roles to the scope like it's now.
Marek
3:58 a.m.
Not sure we even need scope in client templates? Isn't it sufficient to
only have scope control on a per-client?
For example say there's 3 clients in a group of clients:
* service - user and admin roles
* user console
* admin console
You don't want the user console to have scope on the admin console just
because it's in the same group. Also, you don't want the service to have
any scope.
Can anyone come up with an example where scope on the client template would
be useful?
On 16 December 2015 at 14:22, Marek Posolda <mposolda(a)redhat.com> wrote:
On 15/12/15 18:34, Bill Burke wrote:
> So, what to do about scope and client templates? Client templates could
> have "full scope allowed" or define a scope. A client would either
> click "full scope allowed" or it can add additional scoped roles.
>
> Sound ok?
>
yes to me. I suppose each client will still automatically receives his
own client roles to the scope like it's now.
Marek
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
5:39 a.m.
If I understand correctly, to the template you put just scopes, which
you want to be shared for all clients. You can add additional scopes per
client if needed.
Example where it can be useful: You want that each accessToken will
contain all realm roles + all client roles of the client who issued it. So:
- you add all realm roles to the client template scope
- accessToken issued for clientA will contain all realm roles and all
client roles of clientA
- accessToken issued for clientB will contain all realm roles and all
client roles of clientB
In your example, you don't want any scope to be "shared", so there won't
be any scope defined on template and both "user console" and "admin
console" will have just their own scopes.
Marek
On 17/12/15 09:58, Stian Thorgersen wrote:
Not sure we even need scope in client templates? Isn't it
sufficient
to only have scope control on a per-client?
For example say there's 3 clients in a group of clients:
* service - user and admin roles
* user console
* admin console
You don't want the user console to have scope on the admin console
just because it's in the same group. Also, you don't want the service
to have any scope.
Can anyone come up with an example where scope on the client template
would be useful?
On 16 December 2015 at 14:22, Marek Posolda <mposolda(a)redhat.com
<mailto:mposolda@redhat.com>> wrote:
On 15/12/15 18:34, Bill Burke wrote:
> So, what to do about scope and client templates? Client
templates could
> have "full scope allowed" or define a scope. A client would either
> click "full scope allowed" or it can add additional scoped roles.
>
> Sound ok?
>
yes to me. I suppose each client will still automatically receives his
own client roles to the scope like it's now.
Marek
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev
5:42 a.m.
That's not a real example though. I just don't see a real use case where
all clients in a group (app and services) wants to have the same scope.
Scope if highly client specific.
On 17 December 2015 at 11:39, Marek Posolda <mposolda(a)redhat.com> wrote:
If I understand correctly, to the template you put just scopes, which
you
want to be shared for all clients. You can add additional scopes per client
if needed.
Example where it can be useful: You want that each accessToken will
contain all realm roles + all client roles of the client who issued it. So:
- you add all realm roles to the client template scope
- accessToken issued for clientA will contain all realm roles and all
client roles of clientA
- accessToken issued for clientB will contain all realm roles and all
client roles of clientB
In your example, you don't want any scope to be "shared", so there
won't
be any scope defined on template and both "user console" and "admin
console" will have just their own scopes.
Marek
On 17/12/15 09:58, Stian Thorgersen wrote:
Not sure we even need scope in client templates? Isn't it sufficient to
only have scope control on a per-client?
For example say there's 3 clients in a group of clients:
* service - user and admin roles
* user console
* admin console
You don't want the user console to have scope on the admin console just
because it's in the same group. Also, you don't want the service to have
any scope.
Can anyone come up with an example where scope on the client template
would be useful?
On 16 December 2015 at 14:22, Marek Posolda <mposolda(a)redhat.com> wrote:
> On 15/12/15 18:34, Bill Burke wrote:
> > So, what to do about scope and client templates? Client templates could
> > have "full scope allowed" or define a scope. A client would either
> > click "full scope allowed" or it can add additional scoped roles.
> >
> > Sound ok?
> >
> yes to me. I suppose each client will still automatically receives his
> own client roles to the scope like it's now.
>
> Marek
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
6:24 a.m.
Why not real example? I can imagine that in some deployments, people
have some set of "global" roles, which should be available in each
access token issued to any client.
I imagine that in most cases, all those global roles will be defined in
same role namespace. So if we later have a way to specify: "I want all
roles from namespace foo://global/* to be put to scope of clientX" that
should be probably fine too. But IMO we need to avoid situation, when
admin needs to manually add 50 global roles to the scope of each newly
created client.
Btv. I am not sure why service needs to be added to any client template?
Service (bearer-only client) doesn't have it's own access token, so it
doesn't need any shared protocol mappers or scopes. We already have both
tabs "Mappers" and "Scopes" hidden from bearer-only clients.
Shouldn't
we also hide the "Client Template" from client settings of bearer-only
client?
Marek
On 17/12/15 11:42, Stian Thorgersen wrote:
That's not a real example though. I just don't see a real use
case
where all clients in a group (app and services) wants to have the same
scope. Scope if highly client specific.
On 17 December 2015 at 11:39, Marek Posolda <mposolda(a)redhat.com
<mailto:mposolda@redhat.com>> wrote:
If I understand correctly, to the template you put just scopes,
which you want to be shared for all clients. You can add
additional scopes per client if needed.
Example where it can be useful: You want that each accessToken
will contain all realm roles + all client roles of the client who
issued it. So:
- you add all realm roles to the client template scope
- accessToken issued for clientA will contain all realm roles and
all client roles of clientA
- accessToken issued for clientB will contain all realm roles and
all client roles of clientB
In your example, you don't want any scope to be "shared", so there
won't be any scope defined on template and both "user console" and
"admin console" will have just their own scopes.
Marek
On 17/12/15 09:58, Stian Thorgersen wrote:
> Not sure we even need scope in client templates? Isn't it
> sufficient to only have scope control on a per-client?
>
> For example say there's 3 clients in a group of clients:
> * service - user and admin roles
> * user console
> * admin console
>
> You don't want the user console to have scope on the admin
> console just because it's in the same group. Also, you don't want
> the service to have any scope.
>
> Can anyone come up with an example where scope on the client
> template would be useful?
>
> On 16 December 2015 at 14:22, Marek Posolda <mposolda(a)redhat.com
> <mailto:mposolda@redhat.com>> wrote:
>
> On 15/12/15 18:34, Bill Burke wrote:
> > So, what to do about scope and client templates? Client
> templates could
> > have "full scope allowed" or define a scope. A client
> would either
> > click "full scope allowed" or it can add additional scoped
> roles.
> >
> > Sound ok?
> >
> yes to me. I suppose each client will still automatically
> receives his
> own client roles to the scope like it's now.
>
> Marek
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> <mailto:keycloak-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
>
8:39 a.m.
I don't think you've thought this through. Of course you would want
scope on a client template.
Client Template allows scope for Service A, Service B, and Service C.
Client 1, Client 2, and Client 3 all need to access Service A, B, and C.
You'd have to define scope in each client when it would be easier to
define it in the client template.
On 12/17/2015 3:58 AM, Stian Thorgersen wrote:
Not sure we even need scope in client templates? Isn't it
sufficient to
only have scope control on a per-client?
For example say there's 3 clients in a group of clients:
* service - user and admin roles
* user console
* admin console
You don't want the user console to have scope on the admin console just
because it's in the same group. Also, you don't want the service to have
any scope.
Can anyone come up with an example where scope on the client template
would be useful?
On 16 December 2015 at 14:22, Marek Posolda <mposolda(a)redhat.com
<mailto:mposolda@redhat.com>> wrote:
On 15/12/15 18:34, Bill Burke wrote:
> So, what to do about scope and client templates? Client templates could
> have "full scope allowed" or define a scope. A client would either
> click "full scope allowed" or it can add additional scoped roles.
>
> Sound ok?
>
yes to me. I suppose each client will still automatically receives his
own client roles to the scope like it's now.
Marek
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
8:47 a.m.
On 17 December 2015 at 14:39, Bill Burke <bburke(a)redhat.com> wrote:
I don't think you've thought this through. Of course you
would want scope
on a client template.
Client Template allows scope for Service A, Service B, and Service C.
Client 1, Client 2, and Client 3 all need to access Service A, B, and C.
You'd have to define scope in each client when it would be easier to define
it in the client template.
I have thought it through - I just think that it's a lot more likely that
Client 1 will invoke Service A, Client 2 will invoke Service B. Even if all
clients invoke all services they will not have the same scope, but
different scope.
On 12/17/2015 3:58 AM, Stian Thorgersen wrote:
> Not sure we even need scope in client templates? Isn't it sufficient to
> only have scope control on a per-client?
>
> For example say there's 3 clients in a group of clients:
> * service - user and admin roles
> * user console
> * admin console
>
> You don't want the user console to have scope on the admin console just
> because it's in the same group. Also, you don't want the service to have
> any scope.
>
> Can anyone come up with an example where scope on the client template
> would be useful?
>
> On 16 December 2015 at 14:22, Marek Posolda <mposolda(a)redhat.com
> <mailto:mposolda@redhat.com>> wrote:
>
> On 15/12/15 18:34, Bill Burke wrote:
> > So, what to do about scope and client templates? Client templates
> could
> > have "full scope allowed" or define a scope. A client would
either
> > click "full scope allowed" or it can add additional scoped roles.
> >
> > Sound ok?
> >
> yes to me. I suppose each client will still automatically receives his
> own client roles to the scope like it's now.
>
> Marek
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
>
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
8:54 a.m.
On 12/17/2015 8:47 AM, Stian Thorgersen wrote:
On 17 December 2015 at 14:39, Bill Burke <bburke(a)redhat.com
<mailto:bburke@redhat.com>> wrote:
I don't think you've thought this through. Of course you would want
scope on a client template.
Client Template allows scope for Service A, Service B, and Service C.
Client 1, Client 2, and Client 3 all need to access Service A, B,
and C. You'd have to define scope in each client when it would be
easier to define it in the client template.
I have thought it through - I just think that it's a lot more likely
that Client 1 will invoke Service A, Client 2 will invoke Service B.
Even if all clients invoke all services they will not have the same
scope, but different scope.
An argument of "I don't think people will use this" is just as valid as
my argument that I think people will want to use it. The template would
define the scope that is shared between multiple clients, then each
client would add their own additional scope for the other services they
need to use.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:47 a.m.
I don't have a strong disagreement to adding it. Just wondering whether
it's really needed. If you guys think it's going to be used, let's add it.
On 17 December 2015 at 14:54, Bill Burke <bburke(a)redhat.com> wrote:
On 12/17/2015 8:47 AM, Stian Thorgersen wrote:
>
>
> On 17 December 2015 at 14:39, Bill Burke <bburke(a)redhat.com
> <mailto:bburke@redhat.com>> wrote:
>
> I don't think you've thought this through. Of course you would want
> scope on a client template.
>
> Client Template allows scope for Service A, Service B, and Service C.
>
> Client 1, Client 2, and Client 3 all need to access Service A, B,
> and C. You'd have to define scope in each client when it would be
> easier to define it in the client template.
>
>
> I have thought it through - I just think that it's a lot more likely
> that Client 1 will invoke Service A, Client 2 will invoke Service B.
> Even if all clients invoke all services they will not have the same
> scope, but different scope.
>
>
An argument of "I don't think people will use this" is just as valid as my
argument that I think people will want to use it. The template would
define the scope that is shared between multiple clients, then each client
would add their own additional scope for the other services they need to
use.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
3050
days inactive
3052
days old
9 comments
3 participants
participants (3)
-
Bill Burke -
Marek Posolda -
Stian Thorgersen